Skip to main content
Social Sci LibreTexts

14.2: Security Issues for Online Testing

  • Page ID
    88230
  • \( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)

    \( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)

    \( \newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\)

    ( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\)

    \( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\)

    \( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\)

    \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\)

    \( \newcommand{\Span}{\mathrm{span}}\)

    \( \newcommand{\id}{\mathrm{id}}\)

    \( \newcommand{\Span}{\mathrm{span}}\)

    \( \newcommand{\kernel}{\mathrm{null}\,}\)

    \( \newcommand{\range}{\mathrm{range}\,}\)

    \( \newcommand{\RealPart}{\mathrm{Re}}\)

    \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\)

    \( \newcommand{\Argument}{\mathrm{Arg}}\)

    \( \newcommand{\norm}[1]{\| #1 \|}\)

    \( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\)

    \( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\AA}{\unicode[.8,0]{x212B}}\)

    \( \newcommand{\vectorA}[1]{\vec{#1}}      % arrow\)

    \( \newcommand{\vectorAt}[1]{\vec{\text{#1}}}      % arrow\)

    \( \newcommand{\vectorB}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)

    \( \newcommand{\vectorC}[1]{\textbf{#1}} \)

    \( \newcommand{\vectorD}[1]{\overrightarrow{#1}} \)

    \( \newcommand{\vectorDt}[1]{\overrightarrow{\text{#1}}} \)

    \( \newcommand{\vectE}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash{\mathbf {#1}}}} \)

    \( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)

    \( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)

    \(\newcommand{\avec}{\mathbf a}\) \(\newcommand{\bvec}{\mathbf b}\) \(\newcommand{\cvec}{\mathbf c}\) \(\newcommand{\dvec}{\mathbf d}\) \(\newcommand{\dtil}{\widetilde{\mathbf d}}\) \(\newcommand{\evec}{\mathbf e}\) \(\newcommand{\fvec}{\mathbf f}\) \(\newcommand{\nvec}{\mathbf n}\) \(\newcommand{\pvec}{\mathbf p}\) \(\newcommand{\qvec}{\mathbf q}\) \(\newcommand{\svec}{\mathbf s}\) \(\newcommand{\tvec}{\mathbf t}\) \(\newcommand{\uvec}{\mathbf u}\) \(\newcommand{\vvec}{\mathbf v}\) \(\newcommand{\wvec}{\mathbf w}\) \(\newcommand{\xvec}{\mathbf x}\) \(\newcommand{\yvec}{\mathbf y}\) \(\newcommand{\zvec}{\mathbf z}\) \(\newcommand{\rvec}{\mathbf r}\) \(\newcommand{\mvec}{\mathbf m}\) \(\newcommand{\zerovec}{\mathbf 0}\) \(\newcommand{\onevec}{\mathbf 1}\) \(\newcommand{\real}{\mathbb R}\) \(\newcommand{\twovec}[2]{\left[\begin{array}{r}#1 \\ #2 \end{array}\right]}\) \(\newcommand{\ctwovec}[2]{\left[\begin{array}{c}#1 \\ #2 \end{array}\right]}\) \(\newcommand{\threevec}[3]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \end{array}\right]}\) \(\newcommand{\cthreevec}[3]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \end{array}\right]}\) \(\newcommand{\fourvec}[4]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}\) \(\newcommand{\cfourvec}[4]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}\) \(\newcommand{\fivevec}[5]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}\) \(\newcommand{\cfivevec}[5]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}\) \(\newcommand{\mattwo}[4]{\left[\begin{array}{rr}#1 \amp #2 \\ #3 \amp #4 \\ \end{array}\right]}\) \(\newcommand{\laspan}[1]{\text{Span}\{#1\}}\) \(\newcommand{\bcal}{\cal B}\) \(\newcommand{\ccal}{\cal C}\) \(\newcommand{\scal}{\cal S}\) \(\newcommand{\wcal}{\cal W}\) \(\newcommand{\ecal}{\cal E}\) \(\newcommand{\coords}[2]{\left\{#1\right\}_{#2}}\) \(\newcommand{\gray}[1]{\color{gray}{#1}}\) \(\newcommand{\lgray}[1]{\color{lightgray}{#1}}\) \(\newcommand{\rank}{\operatorname{rank}}\) \(\newcommand{\row}{\text{Row}}\) \(\newcommand{\col}{\text{Col}}\) \(\renewcommand{\row}{\text{Row}}\) \(\newcommand{\nul}{\text{Nul}}\) \(\newcommand{\var}{\text{Var}}\) \(\newcommand{\corr}{\text{corr}}\) \(\newcommand{\len}[1]{\left|#1\right|}\) \(\newcommand{\bbar}{\overline{\bvec}}\) \(\newcommand{\bhat}{\widehat{\bvec}}\) \(\newcommand{\bperp}{\bvec^\perp}\) \(\newcommand{\xhat}{\widehat{\xvec}}\) \(\newcommand{\vhat}{\widehat{\vvec}}\) \(\newcommand{\uhat}{\widehat{\uvec}}\) \(\newcommand{\what}{\widehat{\wvec}}\) \(\newcommand{\Sighat}{\widehat{\Sigma}}\) \(\newcommand{\lt}{<}\) \(\newcommand{\gt}{>}\) \(\newcommand{\amp}{&}\) \(\definecolor{fillinmathshade}{gray}{0.9}\)

    Security Issues in A Computer Lab Setting

    In this section, I focus on the WebCT CE 4.x Quiz Tool and on issues related to administering a closed-book quiz/exam in a computer lab. I do not cover all issues of setting-up and running a WebCT quiz in a computer lab, I only consider certain security issues not covered in most reference material on WebCT. As well, even though you may use a different platform than WebCT, many of the issues discussed here are similar for most of the learning management systems (LMSs). In the following discussion it is assumed that the person monitoring the quiz/exam has access to a computer workstation in the lab.

    14.2.1.png
    Figure \(\PageIndex{1}\): You can identify those who have signed into a WebCT quiz through the Submissions page. To open the submissions page, go to the Quizzes/Surveys page and click Submissions.
    14.2.2.png
    Figure \(\PageIndex{2}\): The link to Submissions displays all student accounts in the course, as well as identifying those who have started or completed the quiz.

    The Submissions page provides a wealth of information about a quiz. The page informs the instructor if the quiz is “In progress”, “Not taken”, “Not graded”, or “Partial”. The first two labels are self-explanatory. The last label means that some of the questions in the quiz are not marked. This happens when there are machine gradable questions mixed with short answer or paragraph type questions. The latter question types must be manually marked by a human. The “Not graded” label means that the student either quit the quiz without properly submitting the quiz for grading or the designer configured the quiz so that it either must be manually graded or it must be manually submitted for grading. Clicking a Submissions no. opens the quiz of any student, whether submitted or not. In WebCT, you can view the quiz while it is being completed by the student, before it is even submitted. In fact, the designer can force the quiz to be submitted while it is still being completed, so be careful when accessing live quizzes.

    Though the Submissions view does provide information about a quiz, and allows some monitoring of the quiz environment, computer labs should also be equipped with either a secure browser or computer monitoring software such as NetSupport to protect the security of the quiz environment. Preferably a lab would have both features; neither by itself ensures absolute security. Together, these tools give a high level of security. Nevertheless, even if both these security tools are implemented, you should still consider restricting the IP address of work stations (more on this below in the Quiz Settings).

    14.2.3.png
    Figure \(\PageIndex{3}\): A program like NetSupport (the following is a screen shot from the NetSupport website www.net supportschool.com/quality.htm) allows an instructor to visually monitor all computer screens during a quiz, and this can assist in identifying if a student is viewing a practice set of questions (with answers) during the closed book quiz or even emailing a friend for assistance.
    14.2.4.png
    Figure \(\PageIndex{4}\): When using NetSupport with WebCT you would see something like the screen shown here.
    14.2.5.png
    Figure \(\PageIndex{5}\): NetSupport provides a view of all of the computers in the lab. It also allows you to mouse-over a station icon, which pops-up a magnified window of a student workstation (this is a view in a Thompson Rivers University lab).
    14.2.6.png
    Figure \(\PageIndex{6}\): If the NetSupport view raises suspicion of wrongdoing, you can force the suspicious workstation to expand to the full size of the monitoring workstation.
    14.2.7.png
    Figure \(\PageIndex{7}\): And you can identify all programs the student has activated in the background by viewing the task bar of that workstation.
    14.2.8.png
    Figure \(\PageIndex{8}\): As well, by setting your quizzes a certain colour it is easy to spot workstations that are accessing material that is not part of the quiz. You can do a screen capture of any suspicious workstation, to act as evidence of violation of the rules of the exam setting.

    You can also increase the magnification of the collective class screen. The following demonstrates that it is possible to create other views of the workstations in the lab, which are easy to tab between. You can create a tabbed view of all workstations, of the workstations for only the class, or of the workstations that are only doing the quiz (I frequently allow other students in the lab who are not completing the quiz). The fewer the number of stations monitored the greater the magnification possible to view all stations at once.

    Using A Secure Browser

    As well, by setting your quizzes a certain colour it is easy to spot workstations that are accessing material that is not part of the quiz. You can do a screen capture of any suspicious workstation, to act as evidence of violation of the rules of the exam setting.

    14.2.9.png
    Figure \(\PageIndex{9}\): To prepare for using WebQuery, you must enter the WebCT URL of your Submissions page. To identify that address, open your WebCT Quizzes/Survey page from the designer account. Then click on the link to the quiz.
    14.2.10.png
    Figure \(\PageIndex{10}\):This opens the Quiz Editor for that quiz. Pull your mouse over the background of the quiz page (anywhere but a hypertext link), and right click (this assumes you are using a PC). In IE, a pop-up window appears. Select, View Source.
    14.2.11.png
    Figure \(\PageIndex{11}\): This opens a Notepad window of the source HTML code for that page. Make sure your Notepad is in Word Wrap mode. Click on Edit > Find.
    14.2.12.png
    Figure \(\PageIndex{12}\):Type “Submissions” into the find field and click “Find Next” until you find the anchor link for ‘Submissions’ (code with a “
    14.2.13.png
    Figure \(\PageIndex{13}\): Just ahead of this location is the required URL. Copy and save that address, it is the Submission Page URL. You require this address for the WebQuery which follows.

    Using Excel with WebQuery

    I have up to 200 students registered in a WebCT course. Even though the class breaks down into 24 students per lab/quiz, which is quite manageable, the Submissions screen does not provide an easy way to isolate the specific 24 students taking a quiz; you must view all 200 student accounts at once. It is very difficult to monitor the 24 students taking a quiz when the Submissions screen lists 200, and the 24 are scattered throughout the 200. This is especially a problem if students are assigned to the labs non-alphabetically (the Submissions screen sorts students alphabetically by Last Name only). However, you can use the WebQuery feature of an Excel spreadsheet to assist in the monitoring. All data on any WebCT page can be grabbed by an Excel WebQuery.

    14.2.14.png
    Figure \(\PageIndex{14}\): To execute a WebQuery, open an Excel spreadsheet, click Data > Import External Data > New Web Query (I assume some working knowledge of Excel and I am only sketching out the process here because specifics can vary from system to system).
    14.2.15.png
    Figure \(\PageIndex{15}\): This opens a window in your spreadsheet, which initially displays your default browser Homepage. Enter the location of your WebCT server in the address field.
    14.2.16.png
    Figure \(\PageIndex{16}\): This should bring you to the WebCT server and Login screen (again this varies according to WebCT setup). Login to your designer account. All this is happening in the small window opened in the spreadsheet.
    14.2.17.png
    Figure \(\PageIndex{17}\): Once the URL is pasted, click GO. This then takes you to the Submissions page, listing all the students in the course. Click the yellow which turns to a green . This identifies the data that you want to import from WebCT into Excel.
    14.2.18.png
    Figure \(\PageIndex{18}\): Once the URL is pasted, click GO. This then takes you to the Submissions page, listing all the students in the course. Click the yellow button which turns to a green button. This identifies the data that you want to import from WebCT into Excel.
    14.2.19.png
    Figure \(\PageIndex{19}\): Click Import, importing the data from the Submissions page into your Excel spreadsheet.

    This screen capture displays an Excel spreadsheet, in which I wrote macros and formulas to analyze the data pulled from the Submissions page. Excel has tools that allow you to continuously update the data being generated from WebCT. With WebQuery you are basically creating a real-time Excel window into the Submissions page of your WebCT Quiz. Excel WebQuerys can be used to mine data for a variety of different purposes in WebCT; they are exceptionally useful.

    Configuring The WebCT Quiz

    14.2.19.png
    Figure \(\PageIndex{20}\): To open the Quiz Settings page: From Control Panel > Quizzes/Surveys > [Name of Quiz] > Edit Quiz Settings. Seventeen different areas can be identified in the Quiz settings.

    In the following I only discuss a few of the 17 areas numbered above, many of these areas are covered in other sources about WebCT CE 4.x. I only cover those that are directly relevant to monitoring a quiz in a lab.

    Controlled release of quizzes

    Controlled release to specific students

    • You can release quizzes to the whole class or to only a subsection of the class, even to just one person.
    • Even though you can control release to one account, more than one person can sign into an account (all using the same student/WebCT ID). So, a student could sign into a quiz, and have their bright friend in Timbuktu sign in at exactly the same time and complete the quiz for them, while the student sits in front of the workstation appearing to do the work. The best way to stop this is by controlling the IP Address, and setting and changing the password.

    Controlled release to an IP address

    To reduce the risk that more than one person signs into the same account/quiz, you can release quizzes to a single IP address or to a range of IP address. This at least prevents the person in Timbuktu from accessing the quiz.

    Controlled release by quiz password

    You can set a password to allow entry into a quiz. With this setting, the quiz cannot be started without the password. Not only does this assist to control unauthorized access to the quiz, it also gives you the power to force everyone to start the quiz at approximately the same time. This option combined with the release by User ID and the release by IP address can significantly reduce the possibility of unauthorized access.

    Change the password during the quiz and deny access

    During the quiz, I usually reset the password as soon as everyone is into the quiz, which effectively prevents anyone new from signing in. This helps to prevent someone signing-on from a remote site (if you didn’t restrict access by the IP address and they were emailed the current password by someone taking the quiz), especially someone who was authorized to do the quiz but did not show up.

    Security Issues for totally online courses

    Obviously, the security issues for totally online courses are quite different than for face-to-face courses. There is a fair amount of literature on this topic. Most universities and colleges have testing centres, and for a fee you can have students invigilated during an exam. I have done this with students taking my online logic course. These students arranged with a testing centre to use an Internet-enabled computer for completing their exams. An invigilator was also present. However, you still need to create an exam that is more demanding and that could not be easily completed by cheating. In testing centres, you seldom have the ability to check out the computer system the student uses for the exam, or to specify that there must be a secure browser.


    This page titled 14.2: Security Issues for Online Testing is shared under a CC BY-SA license and was authored, remixed, and/or curated by Sandy Hirtz (BCcampus) .

    • Was this article helpful?